Vulnerability detection in Java source code using a quantum convolutional neural network with self-attentive pooling,...

Area of Science:

• Computer Science
• Software Engineering
• Cybersecurity

Background:

• Software vulnerabilities are a major security risk, requiring advanced detection methods.
• Existing techniques struggle with dependency issues, language bias, and detection granularity.
• Automatic vulnerability detection in Java code remains a critical research area.

Purpose of the Study:

• To develop a novel deep learning system for accurate automatic vulnerability detection in Java code.
• To overcome limitations of current methods, including dependency issues and coarse granularity.
• To enhance semantic and syntactic understanding of code for improved vulnerability identification.

Main Methods:

• Utilized hybrid feature extraction combining graph (control flow graphs, abstract syntax trees, program dependencies) and sequence-based techniques.
• Employed a hybrid neural network (GCN-RFEMLP) and CodeBERT for feature extraction, feeding into a quantum convolutional neural network with self-attentive pooling.
• Addressed long-term dependency and granularity issues using intermediate code representation and inter-procedural slice code, mitigating language bias with a benchmark dataset.

Main Results:

• Achieved a superior accuracy of 99.2% in detecting software vulnerabilities.
• Outperformed existing benchmark methods in vulnerability detection tasks.
• Successfully identified a wide range of Common Weakness Enumeration (CWE) vulnerabilities, including improper input validation, buffer overflows, and SQL injection.

Conclusions:

• The proposed deep learning system offers a highly accurate and effective solution for automatic Java code vulnerability detection.
• The hybrid feature extraction and advanced neural network architecture successfully address key challenges in the field.
• This approach significantly advances the state-of-the-art in software security and vulnerability analysis.